Home
  •  

IIS component discovery failed due to insufficient privileges

Microsoft.Windows.InternetInformationServices.10.0.FailedToPerformIISComponentDiscoveryDueInsufficientPrivs (Rule)

Knowledge Base article:

Summary

The IIS discovery module failed to perform discovery of the IIS components due to the discovery rule using an account with insufficient privileges. Until this error is corrected, components such as application pools or sites on this web server will not be discovered.

Causes

The action account of the agent or the account used in the Privileged Monitoring RunAs profile does not have sufficient privileges to perform IIS discovery.

Resolutions

Configure the Privileged Monitoring RunAs profile to use an account which has access to the configuration files used by IIS. Usually these files are stored in C:\Windows\System32\inetsrv\config.

Element properties:

TargetMicrosoft.Windows.Server.10.0.Computer
CategoryAlert
EnabledFalse
Event_ID33015
Event SourceHealth Service Modules
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
IIS component discovery failed due to insufficient privileges
Event Description: {0}
Event LogOperations Manager

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.10.0.FailedToPerformIISComponentDiscoveryDueInsufficientPrivs" Enabled="false" Target="WindowsvNextDiscovery!Microsoft.Windows.Server.10.0.Computer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">33015</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Health Service Modules</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.10.0.FailedToPerformIISComponentDiscoveryDueInsufficientPrivs.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>